SecuriTricks - CVE-2024-41781

Description

IBM PowerVM Platform KeyStore (IBM PowerVM Hypervisor FW950.00 through FW950.90, FW1030.00 through FW1030.60, FW1050.00 through FW1050.20, and FW1060.00 through FW1060.10 functionality can be compromised if an attacker gains service access to the HMC. An attacker that gains service access to the HMC can locate and through a series of service procedures decrypt data contained in the Platform KeyStore.

Product(s) Impacted

Product	Versions
IBM PowerVM	['FW950.00 - FW950.90', 'FW1030.00 - FW1030.60', 'FW1050.00 - FW1050.20', 'FW1060.00 - FW1060.10']

Weaknesses

Common security weaknesses mapped to this vulnerability.

CWE-497

Exposure of Sensitive System Information to an Unauthorized Control Sphere

The product does not properly prevent sensitive system-level information from being accessed by unauthorized actors who do not have the same level of access to the underlying system as the product does.

References

https://www.ibm.com/support/pages/node/7172698

CVSS Score

5.1 / 10

CVSS Data - 3.1

Attack Vector: ADJACENT_NETWORK
Attack Complexity: HIGH
Privileges Required: HIGH
Scope: CHANGED
Confidentiality Impact: HIGH
Integrity Impact: NONE
Availability Impact: NONE

CVSS:3.1/AV:A/AC:H/PR:H/UI:R/S:C/C:H/I:N/A:N

View Vector String

Timeline

Published: Nov. 22, 2024, 12:15 p.m.
Last Modified: Nov. 22, 2024, 12:15 p.m.

Status : Awaiting Analysis

CVE has been recently published to the CVE List and has been received by the NVD.

More info

Source

psirt@us.ibm.com

CVE-2024-41781